@yawlabs/ctxlint 0.13.1 → 0.13.3

package/dist/index.js

@@ -22404,7 +22404,7 @@ var init_protocol = __esm({
               return;
             }
             const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-            await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
+            await new Promise((resolve15) => setTimeout(resolve15, pollInterval));
             options?.signal?.throwIfAborted();
           }
         } catch (error49) {
@@ -22421,7 +22421,7 @@ var init_protocol = __esm({
        */
       request(request, resultSchema, options) {
         const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-        return new Promise((resolve14, reject) => {
+        return new Promise((resolve15, reject) => {
           const earlyReject = (error49) => {
             reject(error49);
           };
@@ -22499,7 +22499,7 @@ var init_protocol = __esm({
               if (!parseResult.success) {
                 reject(parseResult.error);
               } else {
-                resolve14(parseResult.data);
+                resolve15(parseResult.data);
               }
             } catch (error49) {
               reject(error49);
@@ -22760,12 +22760,12 @@ var init_protocol = __esm({
           }
         } catch {
         }
-        return new Promise((resolve14, reject) => {
+        return new Promise((resolve15, reject) => {
           if (signal.aborted) {
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
             return;
           }
-          const timeoutId = setTimeout(resolve14, interval);
+          const timeoutId = setTimeout(resolve15, interval);
           signal.addEventListener("abort", () => {
             clearTimeout(timeoutId);
             reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -25813,7 +25813,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve14.call(this, root, ref);
+      let _sch = resolve15.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -25840,7 +25840,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve14(root, ref) {
+    function resolve15(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -26418,7 +26418,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve14(baseURI, relativeURI, options) {
+    function resolve15(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -26645,7 +26645,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize: normalize3,
-      resolve: resolve14,
+      resolve: resolve15,
       resolveComponent,
       equal,
       serialize,
@@ -30827,7 +30827,7 @@ var init_mcp = __esm({
         let task = createTaskResult.task;
         const pollInterval = task.pollInterval ?? 5e3;
         while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-          await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
+          await new Promise((resolve15) => setTimeout(resolve15, pollInterval));
           const updatedTask = await extra.taskStore.getTask(taskId);
           if (!updatedTask) {
             throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -31423,12 +31423,12 @@ var init_stdio2 = __esm({
         this.onclose?.();
       }
       send(message) {
-        return new Promise((resolve14) => {
+        return new Promise((resolve15) => {
           const json2 = serializeMessage(message);
           if (this._stdout.write(json2)) {
-            resolve14();
+            resolve15();
           } else {
-            this._stdout.once("drain", resolve14);
+            this._stdout.once("drain", resolve15);
           }
         });
       }
@@ -34433,19 +34433,28 @@ function stripBom(content) {
   return content.charCodeAt(0) === 65279 ? content.slice(1) : content;
 }
 function loadPackageJson(projectRoot) {
-  if (pkgJsonCache?.root === projectRoot) return pkgJsonCache.data;
+  if (pkgJsonCache.has(projectRoot)) {
+    const cached2 = pkgJsonCache.get(projectRoot) ?? null;
+    pkgJsonCache.delete(projectRoot);
+    pkgJsonCache.set(projectRoot, cached2);
+    return cached2;
+  }
+  let data;
   try {
     const content = stripBom(fs2.readFileSync(path.join(projectRoot, "package.json"), "utf-8"));
-    const data = JSON.parse(content);
-    pkgJsonCache = { root: projectRoot, data };
-    return data;
+    data = JSON.parse(content);
   } catch {
-    pkgJsonCache = { root: projectRoot, data: null };
-    return null;
+    data = null;
   }
+  pkgJsonCache.set(projectRoot, data);
+  if (pkgJsonCache.size > PKG_CACHE_MAX_ENTRIES) {
+    const oldest = pkgJsonCache.keys().next().value;
+    if (oldest !== void 0) pkgJsonCache.delete(oldest);
+  }
+  return data;
 }
 function resetPackageJsonCache() {
-  pkgJsonCache = null;
+  pkgJsonCache.clear();
 }
 function fileExists(filePath) {
   try {
@@ -34511,12 +34520,13 @@ function getAllProjectFiles(projectRoot) {
   walk(projectRoot, 0);
   return files;
 }
-var pkgJsonCache, IGNORED_DIRS;
+var PKG_CACHE_MAX_ENTRIES, pkgJsonCache, IGNORED_DIRS;
 var init_fs = __esm({
   "src/utils/fs.ts"() {
     "use strict";
     init_define_WEB_FIRST_SEGMENTS();
-    pkgJsonCache = null;
+    PKG_CACHE_MAX_ENTRIES = 256;
+    pkgJsonCache = /* @__PURE__ */ new Map();
     IGNORED_DIRS = /* @__PURE__ */ new Set([
       "node_modules",
       ".git",
@@ -40917,7 +40927,7 @@ function parseRenameLog(result, targetPath) {
   let basenameFallback = null;
   const lines = result.trim().split("\n");
   for (const line of lines) {
-    const headerMatch = line.match(/^([a-f0-9]{7,40})\s+(.+)$/);
+    const headerMatch = line.match(/^([a-f0-9]{7,40})\s+(\d{4}-\d\d-\d\d\b.*)$/);
     if (headerMatch) {
       currentHash = headerMatch[1].substring(0, 7);
       currentDateStr = headerMatch[2];
@@ -42479,7 +42489,7 @@ async function checkPaths(file2, projectRoot) {
     const resolvedPath = path4.resolve(baseDir, ref.value);
     const normalizedRef = ref.value.replace(/\\/g, "/");
     if (normalizedRef.includes("*")) {
-      const matches = await Ze(normalizedRef, { cwd: baseDir, nodir: false });
+      const matches = path4.isAbsolute(normalizedRef) ? await Ze(normalizedRef, { absolute: true, nodir: false }) : await Ze(normalizedRef, { cwd: baseDir, nodir: false });
       if (matches.length === 0) {
         issues.push({
           severity: "error",
@@ -42603,10 +42613,26 @@ function extractNpxPackage(cmd) {
   }
   return null;
 }
+function wouldNeedPackageJson(cmd) {
+  return NPM_SCRIPT_PATTERN.test(cmd) || PKG_SHORTHAND_PATTERN.test(cmd) || /^npx\b/.test(cmd) || PKG_DEPENDENT_TOOL_PATTERN.test(cmd);
+}
 async function checkCommands(file2, projectRoot) {
   const issues = [];
   const pkgJson = loadPackageJson(projectRoot);
   const makefile = loadMakefile(projectRoot);
+  if (!pkgJson) {
+    const skipped = file2.references.commands.find((ref) => wouldNeedPackageJson(ref.value));
+    if (skipped) {
+      issues.push({
+        severity: "info",
+        check: "commands",
+        ruleId: "commands/package-json-missing",
+        line: skipped.line,
+        message: "package.json missing or unparseable \u2014 command checks skipped",
+        suggestion: "Add a parseable package.json at the project root so script, npx, and tool references can be validated."
+      });
+    }
+  }
   for (const ref of file2.references.commands) {
     const cmd = ref.value;
     const scriptMatch = cmd.match(NPM_SCRIPT_PATTERN);
@@ -42625,9 +42651,7 @@ async function checkCommands(file2, projectRoot) {
       }
       continue;
     }
-    const shorthandMatch = cmd.match(
-      /^(npm|pnpm|yarn|bun)\s+(test|start|build|dev|lint|format|check|typecheck|clean|serve|preview|e2e)\b/
-    );
+    const shorthandMatch = cmd.match(PKG_SHORTHAND_PATTERN);
     if (shorthandMatch && pkgJson) {
       const scriptName = shorthandMatch[2];
       if (pkgJson.scripts && !(scriptName in pkgJson.scripts)) {
@@ -42689,7 +42713,7 @@ async function checkCommands(file2, projectRoot) {
       }
       continue;
     }
-    const toolMatch = cmd.match(/^(vitest|jest|pytest|mocha|eslint|prettier|tsc)\b/);
+    const toolMatch = cmd.match(PKG_DEPENDENT_TOOL_PATTERN);
     if (toolMatch && pkgJson) {
       const tool = toolMatch[1];
       const allDeps = {
@@ -42727,7 +42751,7 @@ function hasMakeTarget(makefile, target) {
   const pattern = new RegExp(`^${target.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*:`, "m");
   return pattern.test(makefile);
 }
-var NPM_SCRIPT_PATTERN, MAKE_PATTERN;
+var NPM_SCRIPT_PATTERN, MAKE_PATTERN, PKG_DEPENDENT_TOOL_PATTERN, PKG_SHORTHAND_PATTERN;
 var init_commands = __esm({
   "src/core/checks/commands.ts"() {
     "use strict";
@@ -42735,6 +42759,8 @@ var init_commands = __esm({
     init_fs();
     NPM_SCRIPT_PATTERN = /^(?:npm\s+run|pnpm(?:\s+run)?|yarn(?:\s+run)?|bun(?:\s+run)?)\s+(\S+)/;
     MAKE_PATTERN = /^make\s+(\S+)/;
+    PKG_DEPENDENT_TOOL_PATTERN = /^(vitest|jest|pytest|mocha|eslint|prettier|tsc)\b/;
+    PKG_SHORTHAND_PATTERN = /^(npm|pnpm|yarn|bun)\s+(test|start|build|dev|lint|format|check|typecheck|clean|serve|preview|e2e)\b/;
   }
 });
 
@@ -42845,7 +42871,7 @@ async function checkTokens(file2, _projectRoot, thresholds = DEFAULT_TOKEN_THRES
 }
 function checkAggregateTokens(files, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
   const total = files.reduce((sum, f) => sum + f.tokens, 0);
-  if (total > thresholds.aggregate && files.length > 1) {
+  if (total >= thresholds.aggregate && files.length > 1) {
     return {
       severity: "warning",
       check: "tokens",
@@ -42924,13 +42950,20 @@ function computeSectionCosts(file2) {
     return { title: s.title, line: s.startLine, tokens: countTokens(body) };
   }).sort((a, b2) => b2.tokens - a.tokens);
 }
-function loadSettingsSources(projectRoot) {
+function loadSettingsSources(projectRoot, includeGlobal) {
+  if (settingsCache?.root === projectRoot && settingsCache.includeGlobal === includeGlobal) {
+    return settingsCache.data;
+  }
   const sources = [];
   const candidates = [
     path7.join(projectRoot, ".claude", "settings.json"),
-    path7.join(projectRoot, ".claude", "settings.local.json"),
-    path7.join(process.env.HOME || process.env.USERPROFILE || "", ".claude", "settings.json")
+    path7.join(projectRoot, ".claude", "settings.local.json")
   ];
+  if (includeGlobal) {
+    candidates.push(
+      path7.join(process.env.HOME || process.env.USERPROFILE || "", ".claude", "settings.json")
+    );
+  }
   for (const p2 of candidates) {
     let content;
     try {
@@ -42944,6 +42977,7 @@ function loadSettingsSources(projectRoot) {
       console.warn(`ctxlint: could not parse ${p2}: ${err.message}`);
     }
   }
+  settingsCache = { root: projectRoot, includeGlobal, data: sources };
   return sources;
 }
 function canonicalizeCommand(backticked) {
@@ -42995,7 +43029,7 @@ function checkHardEnforcement(file2, settings) {
   }
   return issues;
 }
-async function checkTierTokens(file2, projectRoot, thresholds = DEFAULT_TOKEN_THRESHOLDS) {
+async function checkTierTokens(file2, projectRoot, thresholds = DEFAULT_TOKEN_THRESHOLDS, includeGlobal = false) {
   if (!isAlwaysLoaded(file2)) return [];
   const issues = [];
   const threshold = thresholds.tierBreakdown;
@@ -43017,7 +43051,7 @@ async function checkTierTokens(file2, projectRoot, thresholds = DEFAULT_TOKEN_TH
       });
     }
   }
-  const settings = loadSettingsSources(projectRoot);
+  const settings = loadSettingsSources(projectRoot, includeGlobal);
   issues.push(...checkHardEnforcement(file2, settings));
   return issues;
 }
@@ -43038,7 +43072,7 @@ function checkAggregateTierTokens(files, thresholds = DEFAULT_TOKEN_THRESHOLDS)
     suggestion: "Consider moving the largest files or their heaviest sections to on-demand tiers (skills, subagents, memory)."
   };
 }
-var ALWAYS_LOADED_NAMES, TOP_SECTIONS_TO_REPORT, INVIOLABLE_WITH_COMMAND;
+var ALWAYS_LOADED_NAMES, TOP_SECTIONS_TO_REPORT, INVIOLABLE_WITH_COMMAND, settingsCache;
 var init_tier_tokens = __esm({
   "src/core/checks/tier-tokens.ts"() {
     "use strict";
@@ -43068,6 +43102,7 @@ var init_tier_tokens = __esm({
     ];
     TOP_SECTIONS_TO_REPORT = 3;
     INVIOLABLE_WITH_COMMAND = /\b(NEVER|ALWAYS|DON'?T|DO NOT|MUST NOT)\b[^.!?`]{0,80}`([^`]+)`/i;
+    settingsCache = null;
   }
 });
 
@@ -43164,7 +43199,8 @@ async function checkRedundancy(file2, projectRoot) {
             ruleId: "redundancy/tech-mention",
             line: i2 + 1,
             message: `"${mention}" is in package.json ${pkgJson.dependencies?.[pkg] ? "dependencies" : pkgJson.devDependencies?.[pkg] ? "devDependencies" : pkgJson.peerDependencies?.[pkg] ? "peerDependencies" : "optionalDependencies"} \u2014 agent can infer this`,
-            suggestion: `~${wastedTokens} tokens could be saved`
+            suggestion: `~${wastedTokens} tokens could be saved`,
+            wastedTokens
           });
         }
       }
@@ -43178,7 +43214,8 @@ async function checkRedundancy(file2, projectRoot) {
     );
     if (dirMatch) {
       const dir = dirMatch[1].replace(/[`"]/g, "");
-      const fullPath = path8.resolve(projectRoot, dir);
+      const baseDir = dir.startsWith("./") || dir.startsWith("../") ? path8.dirname(file2.filePath) : projectRoot;
+      const fullPath = path8.resolve(baseDir, dir);
       if (isDirectory(fullPath)) {
         issues.push({
           severity: "info",
@@ -43410,19 +43447,23 @@ var init_contradictions = __esm({
         options: [
           {
             label: "Jest",
-            patterns: [/\buse\s+jest\b/i, /\bjest\s+for\s+test/i, /\btest.*with\s+jest\b/i]
+            // The third pattern bounds the gap between `test` and `with <fw>` to a
+            // few intra-clause chars so prose like "run our test suite and then
+            // deploy with jest" no longer matches the framework directive — only
+            // tight phrasings like "test with jest" / "tests run with jest" do.
+            patterns: [/\buse\s+jest\b/i, /\bjest\s+for\s+test/i, /\btest\w*\s+with\s+jest\b/i]
           },
           {
             label: "Vitest",
-            patterns: [/\buse\s+vitest\b/i, /\bvitest\s+for\s+test/i, /\btest.*with\s+vitest\b/i]
+            patterns: [/\buse\s+vitest\b/i, /\bvitest\s+for\s+test/i, /\btest\w*\s+with\s+vitest\b/i]
           },
           {
             label: "Mocha",
-            patterns: [/\buse\s+mocha\b/i, /\bmocha\s+for\s+test/i, /\btest.*with\s+mocha\b/i]
+            patterns: [/\buse\s+mocha\b/i, /\bmocha\s+for\s+test/i, /\btest\w*\s+with\s+mocha\b/i]
           },
           {
             label: "pytest",
-            patterns: [/\buse\s+pytest\b/i, /\bpytest\s+for\s+test/i, /\btest.*with\s+pytest\b/i]
+            patterns: [/\buse\s+pytest\b/i, /\bpytest\s+for\s+test/i, /\btest\w*\s+with\s+pytest\b/i]
           },
           {
             label: "Playwright",
@@ -43477,19 +43518,11 @@ var init_contradictions = __esm({
           },
           {
             label: "2 spaces",
-            patterns: [
-              /\b2[\s-]?space\s+indent/i,
-              /\bindent\s+with\s+2\s+spaces/i,
-              /\b2[\s-]?space\s+tabs?\b/i
-            ]
+            patterns: [/\b2[\s-]?space\s+indent/i, /\bindent\s+with\s+2\s+spaces/i]
           },
           {
             label: "4 spaces",
-            patterns: [
-              /\b4[\s-]?space\s+indent/i,
-              /\bindent\s+with\s+4\s+spaces/i,
-              /\b4[\s-]?space\s+tabs?\b/i
-            ]
+            patterns: [/\b4[\s-]?space\s+indent/i, /\bindent\s+with\s+4\s+spaces/i]
           }
         ]
       },
@@ -43651,10 +43684,11 @@ function hasUnbalancedBracketsOrQuotes(val) {
     if (square < 0 || curly < 0) return true;
   }
   if (square !== 0 || curly !== 0) return true;
-  const doubleQuotes = (val.match(/"/g) || []).length;
-  const singleQuotes = (val.match(/'/g) || []).length;
-  if (doubleQuotes % 2 !== 0) return true;
-  if (singleQuotes % 2 !== 0) return true;
+  const quoteChar = val[0];
+  if (quoteChar === '"' || quoteChar === "'") {
+    const count = (val.match(quoteChar === '"' ? /"/g : /'/g) || []).length;
+    if (count % 2 !== 0) return true;
+  }
   return false;
 }
 async function checkFrontmatter(file2, _projectRoot) {
@@ -44039,7 +44073,9 @@ async function checkMcpSecurity(config2, _projectRoot) {
       try {
         if (!isEnvVarRef(server2.url)) {
           const parsed = new URL(server2.url);
-          if (parsed.protocol === "http:" && parsed.hostname !== "localhost" && parsed.hostname !== "127.0.0.1" && parsed.hostname !== "::1") {
+          const host = parsed.hostname.replace(/^\[|\]$/g, "");
+          const isLoopback = host === "localhost" || host === "::1" || host.startsWith("127.");
+          if (parsed.protocol === "http:" && !isLoopback) {
             issues.push({
               severity: "warning",
               check: "mcp-security",
@@ -44495,6 +44531,7 @@ function checkMissingFromClient(configs) {
 function collectServerNameKeys(content, rootKey) {
   const names = [];
   let i2 = 0;
+  let keyStart = -1;
   let depth = 0;
   let inString = false;
   let escape2 = false;
@@ -44520,6 +44557,7 @@ function collectServerNameKeys(content, rootKey) {
         inString = true;
         collectingKey = true;
         pendingKey = "";
+        keyStart = i2;
       } else {
         inString = false;
         let j3 = i2 + 1;
@@ -44528,7 +44566,11 @@ function collectServerNameKeys(content, rootKey) {
           if (pendingKey === rootKey && rootKeyDepth === -1) {
             rootKeyDepth = depth;
           } else if (rootKeyDepth !== -1 && depth === rootKeyDepth + 1) {
-            names.push(pendingKey);
+            let line = 1;
+            for (let k3 = 0; k3 < keyStart; k3++) {
+              if (content[k3] === "\n") line++;
+            }
+            names.push({ name: pendingKey, line });
           }
         }
         collectingKey = false;
@@ -44554,14 +44596,19 @@ function checkSingleFileIssues(configs) {
     if (!config2.actualRootKey) continue;
     const serverKeys = collectServerNameKeys(config2.content, config2.actualRootKey);
     const counts = /* @__PURE__ */ new Map();
-    for (const k3 of serverKeys) counts.set(k3, (counts.get(k3) ?? 0) + 1);
+    const secondLines = /* @__PURE__ */ new Map();
+    for (const { name, line } of serverKeys) {
+      const next = (counts.get(name) ?? 0) + 1;
+      counts.set(name, next);
+      if (next === 2) secondLines.set(name, line);
+    }
     for (const [name, count] of counts) {
       if (count > 1) {
         issues.push({
           severity: "warning",
           check: "mcp-consistency",
           ruleId: "mcp-consistency/duplicate-server-name",
-          line: 1,
+          line: secondLines.get(name) ?? 1,
           message: `Duplicate server name "${name}" in ${config2.relativePath} \u2014 only the last definition is used`
         });
       }
@@ -44720,6 +44767,17 @@ async function checkMcphApibase(config2, _projectRoot) {
     });
     return issues;
   }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    issues.push({
+      severity: "error",
+      check: "mcph-apibase",
+      ruleId: "mcph-apibase/invalid-apibase",
+      line: pos.line,
+      message: `"apiBase" must be an http(s) URL, got ${parsed.protocol.replace(/:$/, "")}`,
+      suggestion: `Use an absolute http(s) URL, e.g. "https://mcp.hosting".`
+    });
+    return issues;
+  }
   if (parsed.protocol === "http:" && !isPrivateHost(parsed.hostname)) {
     issues.push({
       severity: "warning",
@@ -44864,13 +44922,13 @@ var init_gitignore = __esm({
 // src/core/session-parser.ts
 import { readFile } from "node:fs/promises";
 import { readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname2, resolve as resolve4 } from "node:path";
+import { dirname as dirname3, resolve as resolve4 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadWebFirstSegments() {
   if (typeof define_WEB_FIRST_SEGMENTS_default !== "undefined") {
     return new Set(define_WEB_FIRST_SEGMENTS_default);
   }
-  const __dir = dirname2(fileURLToPath(import.meta.url));
+  const __dir = dirname3(fileURLToPath(import.meta.url));
   const fixturePath = resolve4(__dir, "../../tests/fixtures/web-first-segments.json");
   const raw = JSON.parse(readFileSync4(fixturePath, "utf-8"));
   const list = Array.isArray(raw) ? raw : raw.segments;
@@ -44913,6 +44971,12 @@ function extractPathsClassified(content) {
       candidates.push(p2);
     }
   }
+  for (const match of content.matchAll(DRIVE_ABS_PATH)) {
+    const p2 = match[1].replace(/[)}\]]+$/, "");
+    if (p2.length > 2) {
+      candidates.push(p2);
+    }
+  }
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const value of candidates) {
@@ -44965,7 +45029,7 @@ async function parseMemoryFile(filePath, projectDir) {
     referencedPaths
   };
 }
-var WEB_FIRST_SEGMENTS, PATH_PATTERN2, BARE_FILE_PATH;
+var WEB_FIRST_SEGMENTS, PATH_PATTERN2, BARE_FILE_PATH, DRIVE_ABS_PATH;
 var init_session_parser = __esm({
   "src/core/session-parser.ts"() {
     "use strict";
@@ -44974,6 +45038,7 @@ var init_session_parser = __esm({
     WEB_FIRST_SEGMENTS = loadWebFirstSegments();
     PATH_PATTERN2 = /(?:^|\s|['"`(])([.~/][^\s'"`),;:!?]+)/g;
     BARE_FILE_PATH = /(?:^|[\s`"'(])([\w][\w-]*(?:\/[\w.-]+)+\.[a-zA-Z0-9]{1,8})\b/g;
+    DRIVE_ABS_PATH = /(?:^|[\s`"'(])([A-Za-z]:[\\/][^\s'"`),;!?]+)/g;
   }
 });
 
@@ -44981,7 +45046,7 @@ var init_session_parser = __esm({
 import { readdir, stat } from "node:fs/promises";
 import { createReadStream } from "node:fs";
 import { createInterface } from "node:readline";
-import { dirname as dirname3, join as join5, resolve as resolve5 } from "node:path";
+import { dirname as dirname4, join as join5, resolve as resolve5 } from "node:path";
 import { existsSync } from "node:fs";
 function detectProviders() {
   if (!home) return [];
@@ -45076,7 +45141,7 @@ function detectAiderInSiblings(siblings) {
   return null;
 }
 async function detectSiblings(projectRoot) {
-  const parentDir = dirname3(resolve5(projectRoot));
+  const parentDir = dirname4(resolve5(projectRoot));
   let entries;
   try {
     entries = await readdir(parentDir);
@@ -45173,7 +45238,12 @@ var init_session_scanner = __esm({
       },
       {
         provider: "goose",
-        dir: process.platform === "win32" ? join5(process.env.APPDATA || "", "Block", "goose") : join5(home, ".config", "goose")
+        // On win32 the goose dir lives under %APPDATA%. If APPDATA is unset,
+        // `join('', 'Block', 'goose')` yields the cwd-relative `Block/goose`,
+        // which the HOME guard in `detectProviders` does NOT catch (HOME/USERPROFILE
+        // may still be set). Leave the dir empty so `existsSync('')` is always false
+        // and we never match a cwd-relative `Block/goose`, mirroring the HOME-guard intent.
+        dir: process.platform === "win32" ? process.env.APPDATA ? join5(process.env.APPDATA, "Block", "goose") : "" : join5(home, ".config", "goose")
       },
       { provider: "continue", dir: join5(home, ".continue") },
       {
@@ -45189,43 +45259,68 @@ import { resolve as resolve6, basename as basename3 } from "node:path";
 function normalizePath2(p2) {
   return resolve6(p2).replace(/\\/g, "/").toLowerCase();
 }
+function extractSecretName(display) {
+  const prefixMatch = display.match(SECRET_SET_PREFIX);
+  if (!prefixMatch) return void 0;
+  const rest = display.slice(prefixMatch.index + prefixMatch[0].length);
+  const tokens = rest.split(/\s+/).filter((t2) => t2.length > 0);
+  for (let i2 = 0; i2 < tokens.length; i2++) {
+    const tok = tokens[i2];
+    if (!tok.startsWith("-")) return tok;
+    if (VALUE_FLAGS.has(tok) && !tok.includes("=")) i2++;
+  }
+  return void 0;
+}
+function repoBasename(repoSpec) {
+  return (repoSpec.split("/").pop() || repoSpec).toLowerCase();
+}
+function repoMatchesSibling(repoSpec, sib) {
+  const slash = repoSpec.indexOf("/");
+  const sibBase = basename3(normalizePath2(sib.path));
+  if (slash === -1) {
+    return repoBasename(repoSpec) === sibBase;
+  }
+  const owner = repoSpec.slice(0, slash).toLowerCase();
+  const repoName = repoSpec.slice(slash + 1).toLowerCase();
+  if (repoName !== sibBase) return false;
+  if (sib.gitOrg) return sib.gitOrg.toLowerCase() === owner;
+  if (sib.gitRemoteUrl) {
+    return sib.gitRemoteUrl.toLowerCase().includes(`${owner}/${repoName}`);
+  }
+  return true;
+}
 async function checkMissingSecret(ctx) {
   const issues = [];
   const secrets = [];
   for (const entry of ctx.history) {
-    const match = entry.display.match(SECRET_SET_PATTERN) || entry.display.match(SECRET_SET_SIMPLE);
-    if (!match) continue;
+    const name = extractSecretName(entry.display);
+    if (!name) continue;
+    const repoMatch = entry.display.match(REPO_FLAG_PATTERN);
     secrets.push({
-      name: match[1],
-      repo: match[2],
+      name,
+      repo: repoMatch ? repoMatch[1] : void 0,
       project: entry.project
     });
   }
   if (secrets.length === 0) return issues;
   const byName = /* @__PURE__ */ new Map();
   for (const s of secrets) {
-    if (!byName.has(s.name)) byName.set(s.name, /* @__PURE__ */ new Set());
-    byName.get(s.name).add(s.project);
-    if (s.repo) byName.get(s.name).add(s.repo);
+    if (!byName.has(s.name)) byName.set(s.name, { projects: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set() });
+    const bucket = byName.get(s.name);
+    bucket.projects.add(s.project);
+    if (s.repo) bucket.repos.add(s.repo);
   }
   const currentNorm = normalizePath2(ctx.currentProject);
   const currentBase = basename3(currentNorm);
-  for (const [secretName, projects] of byName) {
+  for (const [secretName, { projects, repos }] of byName) {
     const normalizedProjects = [...projects].map(normalizePath2);
-    const currentHas = normalizedProjects.some((p2) => {
-      if (p2 === currentNorm) return true;
-      const lastSegment = p2.split("/").pop() || "";
-      return lastSegment === currentBase;
-    });
+    const repoSpecs = [...repos];
+    const currentHas = normalizedProjects.some((p2) => p2 === currentNorm) || repoSpecs.some((r2) => repoBasename(r2) === currentBase);
     if (currentHas) continue;
     const siblingMatches = ctx.siblings.filter((sib) => {
       const sibNorm = normalizePath2(sib.path);
-      const sibBase = basename3(sibNorm);
-      return normalizedProjects.some((p2) => {
-        if (p2 === sibNorm) return true;
-        const lastSegment = p2.split("/").pop() || "";
-        return lastSegment === sibBase;
-      });
+      if (normalizedProjects.some((p2) => p2 === sibNorm)) return true;
+      return repoSpecs.some((r2) => repoMatchesSibling(r2, sib));
     });
     if (siblingMatches.length >= 2) {
       const sibNames = siblingMatches.map((s) => s.name).join(", ");
@@ -45242,19 +45337,20 @@ async function checkMissingSecret(ctx) {
   }
   return issues;
 }
-var SECRET_SET_PATTERN, SECRET_SET_SIMPLE;
+var SECRET_SET_PREFIX, REPO_FLAG_PATTERN, VALUE_FLAGS;
 var init_missing_secret = __esm({
   "src/core/checks/session/missing-secret.ts"() {
     "use strict";
     init_define_WEB_FIRST_SEGMENTS();
-    SECRET_SET_PATTERN = /gh\s+secret\s+set\s+(\S+)\s+--repo\s+(\S+)/;
-    SECRET_SET_SIMPLE = /gh\s+secret\s+set\s+(\S+)/;
+    SECRET_SET_PREFIX = /gh\s+secret\s+set\s+/;
+    REPO_FLAG_PATTERN = /--repo\s+(\S+)/;
+    VALUE_FLAGS = /* @__PURE__ */ new Set(["--repo", "-R", "-b", "--body", "--app", "--env"]);
   }
 });
 
 // src/core/checks/session/diverged-file.ts
 import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
-import { join as join6 } from "node:path";
+import { join as join6, resolve as resolve7 } from "node:path";
 import { existsSync as existsSync2 } from "node:fs";
 async function loadLineSet(absPath) {
   let mtimeMs;
@@ -45303,11 +45399,16 @@ async function checkDivergedFile(ctx) {
         bothEmptyIsIdentical: true
       });
       if (overlap >= 0.2 && overlap < 0.9) {
-        diverged.push({ sibling: sib.name, overlap: Math.round(overlap * 100) });
+        diverged.push({
+          sibling: sib.name,
+          overlap: Math.round(overlap * 100),
+          path: resolve7(sibPath)
+        });
       }
     }
     if (diverged.length > 0) {
       const details = diverged.map((d) => `${d.sibling} (${d.overlap}% overlap)`).join(", ");
+      const sibPaths = diverged.map((d) => `  ${d.sibling}: ${d.path}`).join("\n");
       issues.push({
         severity: "warning",
         check: "session-diverged-file",
@@ -45315,7 +45416,9 @@ async function checkDivergedFile(ctx) {
         line: 0,
         message: `${fileName} has diverged from sibling repos: ${details}`,
         suggestion: `Compare with sibling versions to identify unintentional drift`,
-        detail: `Files with the same name across sibling repos should be kept in sync when they serve the same purpose`
+        detail: `File: ${resolve7(currentPath)}
+Diverged siblings:
+${sibPaths}`
       });
     }
   }
@@ -45402,15 +45505,15 @@ var init_missing_workflow = __esm({
 
 // src/core/checks/session/stale-memory.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { resolve as resolve7, isAbsolute as isAbsolute2 } from "node:path";
+import { resolve as resolve8, isAbsolute as isAbsolute3 } from "node:path";
 function resolveRef2(ref, projectRoot) {
   if (ref.startsWith("~/") || ref === "~") {
     const home2 = process.env.HOME || process.env.USERPROFILE;
     if (!home2) return null;
-    return ref === "~" ? home2 : resolve7(home2, ref.slice(2));
+    return ref === "~" ? home2 : resolve8(home2, ref.slice(2));
   }
-  if (isAbsolute2(ref)) return ref;
-  return resolve7(projectRoot, ref);
+  if (isAbsolute3(ref)) return ref;
+  return resolve8(projectRoot, ref);
 }
 async function checkStaleMemory(ctx) {
   const issues = [];
@@ -45434,6 +45537,7 @@ async function checkStaleMemory(ctx) {
         ruleId: "session-stale-memory/stale-memory",
         line: 0,
         message: `Memory "${name}" references ${brokenPaths.length} path(s) that no longer exist: ${brokenPaths.join(", ")}`,
+        affectedPaths: brokenPaths,
         suggestion: `Update or remove the memory file: ${mem.filePath}`,
         detail: `Memory files with broken path references may cause the AI agent to follow stale instructions`
       });
@@ -45453,7 +45557,15 @@ var init_stale_memory = __esm({
 async function checkDuplicateMemory(ctx) {
   const issues = [];
   const reported = /* @__PURE__ */ new Set();
-  const lineSets = ctx.memories.map((m) => toLineSet(m.content, MIN_TOKEN_LEN2));
+  const lineSets = new Array(ctx.memories.length);
+  const getLineSet = (idx) => {
+    let ls2 = lineSets[idx];
+    if (ls2 === void 0) {
+      ls2 = toLineSet(ctx.memories[idx].content, MIN_TOKEN_LEN2);
+      lineSets[idx] = ls2;
+    }
+    return ls2;
+  };
   for (let i2 = 0; i2 < ctx.memories.length; i2++) {
     for (let j3 = i2 + 1; j3 < ctx.memories.length; j3++) {
       const a = ctx.memories[i2];
@@ -45463,7 +45575,7 @@ async function checkDuplicateMemory(ctx) {
       const bIsCurrent = projectDirMatchesPath(b2.projectDir, ctx.currentProject);
       if (!aIsCurrent && !bIsCurrent) continue;
       if (a.content.length < 50 || b2.content.length < 50) continue;
-      const overlap = jaccardSimilarityFromSets(lineSets[i2], lineSets[j3]);
+      const overlap = jaccardSimilarityFromSets(getLineSet(i2), getLineSet(j3));
       if (overlap < 0.6) continue;
       const pairKey = [a.filePath, b2.filePath].sort().join("::");
       if (reported.has(pairKey)) continue;
@@ -45497,9 +45609,9 @@ var init_duplicate_memory = __esm({
 });
 
 // src/core/checks/session/loop-detection.ts
-import { resolve as resolve8 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 function normalizeProject(p2) {
-  return resolve8(p2).replace(/\\/g, "/");
+  return resolve9(p2).replace(/\\/g, "/");
 }
 function findConsecutiveRepeats(displays) {
   const results = [];
@@ -45509,13 +45621,13 @@ function findConsecutiveRepeats(displays) {
     while (j3 < displays.length && displays[j3] === displays[i2]) j3++;
     const count = j3 - i2;
     if (count >= CONSECUTIVE_THRESHOLD) {
-      results.push({ command: displays[i2], count });
+      results.push({ command: displays[i2], count, startIdx: i2, endIdx: j3 });
     }
     i2 = j3;
   }
   return results;
 }
-function findCyclicPatterns(displays) {
+function findCyclicPatterns(displays, consecutiveSpans) {
   const results = [];
   for (let cycleLen = 2; cycleLen <= MAX_CYCLE_LENGTH; cycleLen++) {
     for (let start = 0; start <= displays.length - cycleLen * CYCLE_REPEAT_THRESHOLD; start++) {
@@ -45533,8 +45645,13 @@ function findCyclicPatterns(displays) {
         }
       }
       if (repeats >= CYCLE_REPEAT_THRESHOLD) {
+        const cycleEnd = start + cycleLen * repeats;
+        const overlapsConsecutive = consecutiveSpans.some(
+          (s) => s.startIdx < cycleEnd && start < s.endIdx
+        );
+        if (overlapsConsecutive) continue;
         const alreadyCovered = results.some(
-          (r2) => r2.startIdx <= start && r2.startIdx + r2.cycle.length * r2.repeats >= start + cycleLen * repeats
+          (r2) => r2.startIdx <= start && r2.startIdx + r2.cycle.length * r2.repeats >= cycleEnd
         );
         if (!alreadyCovered) {
           results.push({ cycle, repeats, startIdx: start });
@@ -45563,7 +45680,8 @@ async function checkLoopDetection(ctx) {
       suggestion: "An agent may be looping on this command. Check history.jsonl for context on what went wrong"
     });
   }
-  const cycles = findCyclicPatterns(displays);
+  const consecutiveSpans = repeats.map((r2) => ({ startIdx: r2.startIdx, endIdx: r2.endIdx }));
+  const cycles = findCyclicPatterns(displays, consecutiveSpans);
   for (const { cycle, repeats: reps } of cycles) {
     const cycleStr = cycle.map((c3) => c3.length > 40 ? c3.slice(0, 37) + "..." : c3).join(" -> ");
     issues.push({
@@ -45613,7 +45731,7 @@ async function checkMemoryIndexOverflow(ctx) {
     issues.push({
       severity: "warning",
       check: "session-memory-index-overflow",
-      ruleId: "session-memory-index-overflow/memory-index-overflow",
+      ruleId: "session-memory-index-overflow/line-overflow",
       line: MAX_LINES + 1,
       message: `MEMORY.md has ${lineCount.toLocaleString()} lines \u2014 only the first ${MAX_LINES} are loaded. ${excess.toLocaleString()} line(s) are effectively invisible to the agent.`,
       detail: `File: ${memoryFile}`,
@@ -45625,7 +45743,7 @@ async function checkMemoryIndexOverflow(ctx) {
     issues.push({
       severity: "warning",
       check: "session-memory-index-overflow",
-      ruleId: "session-memory-index-overflow/memory-index-overflow",
+      ruleId: "session-memory-index-overflow/byte-overflow",
       line: 0,
       message: `MEMORY.md is ${byteSize.toLocaleString()} bytes \u2014 only the first ${MAX_BYTES.toLocaleString()} bytes are loaded. ~${excess.toLocaleString()} bytes are effectively invisible.`,
       detail: `File: ${memoryFile}`,
@@ -45668,9 +45786,12 @@ async function findReleaseWorkflows(projectRoot) {
     }
     try {
       const content = stripBom(await readFile4(join9(workflowDir, f), "utf-8"));
-      const nameMatch = content.match(/^name:\s*(.+)$/m);
-      if (nameMatch && RELEASE_FILENAME_PATTERNS.some((p2) => p2.test(nameMatch[1]))) {
-        releaseWorkflows.push(f);
+      const nameMatch = content.match(/^\s*name:\s*(.+?)\s*$/m);
+      if (nameMatch) {
+        const name = nameMatch[1].replace(/^(['"])(.*)\1$/, "$2");
+        if (RELEASE_FILENAME_PATTERNS.some((p2) => p2.test(name))) {
+          releaseWorkflows.push(f);
+        }
       }
     } catch {
     }
@@ -46524,6 +46645,7 @@ function extractPathsFromMessage(msg) {
 function applyIgnoreRules(issues, rules) {
   const compiled = compileRules(rules);
   const kept = [];
+  const keepMask = [];
   let dropped = 0;
   for (const issue2 of issues) {
     let suppress = false;
@@ -46531,7 +46653,7 @@ function applyIgnoreRules(issues, rules) {
       if (rule.check !== issue2.check) continue;
       if (rule.pathPattern) {
         if (issue2.check !== "session-stale-memory") continue;
-        const paths = extractPathsFromMessage(issue2.message);
+        const paths = issue2.affectedPaths ?? extractPathsFromMessage(issue2.message);
         if (paths.length === 0) continue;
         const allMatch = paths.every((p2) => rule.pathPattern.test(p2));
         if (!allMatch) continue;
@@ -46543,12 +46665,15 @@ function applyIgnoreRules(issues, rules) {
     }
     if (suppress) {
       dropped++;
+      keepMask.push(false);
     } else {
       kept.push(issue2);
+      keepMask.push(true);
     }
   }
   return {
     kept,
+    keepMask,
     dropped,
     unusedRules: compiled.filter((r2) => !r2.fired).map(stripCompiled),
     rulesMissingReason: rules.filter((r2) => !r2.reason)
@@ -46583,12 +46708,12 @@ var init_types3 = __esm({
 
 // src/version.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-import { resolve as resolve11, dirname as dirname5 } from "node:path";
+import { resolve as resolve12, dirname as dirname6 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function loadVersion() {
-  if (true) return "0.13.0";
-  const __dir = dirname5(fileURLToPath2(import.meta.url));
-  const pkgPath = resolve11(__dir, "../package.json");
+  if (true) return "0.13.2";
+  const __dir = dirname6(fileURLToPath2(import.meta.url));
+  const pkgPath = resolve12(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
   return pkg.version;
 }
@@ -46641,7 +46766,9 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       if (activeChecks.includes("tokens"))
         checkPromises.push(checkTokens(file2, projectRoot, thresholds));
       if (activeChecks.includes("tier-tokens"))
-        checkPromises.push(checkTierTokens(file2, projectRoot, thresholds));
+        checkPromises.push(
+          checkTierTokens(file2, projectRoot, thresholds, Boolean(options.hooksGlobal))
+        );
       if (activeChecks.includes("redundancy"))
         checkPromises.push(checkRedundancy(file2, projectRoot));
       if (activeChecks.includes("frontmatter"))
@@ -46896,10 +47023,9 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
       }
     });
     const applied = applyIgnoreRules(flat, options.ignoreRules);
-    const keptSet = new Set(applied.kept);
     const rebuilt = fileResults.map(() => []);
     flat.forEach((issue2, i2) => {
-      if (keptSet.has(issue2)) rebuilt[owners[i2]].push(issue2);
+      if (applied.keepMask[i2]) rebuilt[owners[i2]].push(issue2);
     });
     fileResults.forEach((fr, idx) => {
       fr.issues = rebuilt[idx];
@@ -46913,9 +47039,13 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
   let estimatedWaste = 0;
   for (const fr of fileResults) {
     for (const issue2 of fr.issues) {
-      if (issue2.check === "redundancy" && issue2.suggestion) {
-        const tokenMatch = issue2.suggestion.match(/~(\d+)\s+tokens/);
-        if (tokenMatch) estimatedWaste += parseInt(tokenMatch[1], 10);
+      if (issue2.check !== "redundancy") continue;
+      if (typeof issue2.wastedTokens === "number") {
+        estimatedWaste += issue2.wastedTokens;
+      } else if (issue2.suggestion) {
+        for (const m of issue2.suggestion.matchAll(/~(\d+)\s+tokens/g)) {
+          estimatedWaste += parseInt(m[1], 10);
+        }
       }
     }
   }
@@ -47593,12 +47723,6 @@ function applyFixes(result, options = {}) {
   } : console.log.bind(console);
   const dryRun = options.dryRun ?? false;
   const skipSymlinks = options.skipSymlinks ?? true;
-  const symlinkFiles = /* @__PURE__ */ new Set();
-  if (skipSymlinks) {
-    for (const f of result.files) {
-      if (f.isSymlink) symlinkFiles.add(f.path);
-    }
-  }
   const fixesByFile = /* @__PURE__ */ new Map();
   const dedupeKeys = /* @__PURE__ */ new Map();
   const skippedSymlinks = /* @__PURE__ */ new Set();
@@ -48154,7 +48278,7 @@ var init_server3 = __esm({
         checks: external_exports3.array(mcphCheckEnum).optional().describe("Specific mcph checks to run (default: all mcph-* checks)."),
         includeGlobal: external_exports3.boolean().optional().describe("Also scan ~/.mcph.json (user-global config)."),
         strictEnvToken: external_exports3.boolean().optional().describe(
-          "Upgrade mcph-config/prefer-env-token from warning to error (env-var-only posture)."
+          "Upgrade mcph-token-security/prefer-env-token from warning to error (env-var-only posture)."
         )
       },
       {
@@ -54801,6 +54925,11 @@ function formatText(result, verbose = false) {
     lines.push("Session audit scanned");
     renderedAnySummary = true;
   }
+  if (groups.skill.length > 0) {
+    if (renderedAnySummary) lines.push("");
+    lines.push("Skill audit scanned");
+    renderedAnySummary = true;
+  }
   if (!renderedAnySummary) {
     lines.push(`Found ${result.files.length} file${result.files.length !== 1 ? "s" : ""}`);
   }
@@ -54896,12 +55025,13 @@ function formatTokenReport(result) {
     source_default.dim("  (counts use GPT-4 cl100k_base tokenizer \u2014 Claude counts may vary slightly)")
   );
   lines.push("");
-  const maxPathLen = Math.max(...result.files.map((f) => f.path.length), 4);
+  const realFiles = result.files.filter((f) => !isSyntheticBucket(f.path));
+  const maxPathLen = Math.max(...realFiles.map((f) => f.path.length), 4);
   lines.push(
     `  ${source_default.dim("File".padEnd(maxPathLen))}  ${source_default.dim("Tokens".padStart(8))}  ${source_default.dim("Lines".padStart(6))}`
   );
   lines.push(`  ${"-".repeat(maxPathLen)}  ${"-".repeat(8)}  ${"-".repeat(6)}`);
-  for (const file2 of result.files) {
+  for (const file2 of realFiles) {
     const tokenStr = file2.tokens.toLocaleString().padStart(8);
     const lineStr = file2.lines.toString().padStart(6);
     lines.push(`  ${file2.path.padEnd(maxPathLen)}  ${tokenStr}  ${lineStr}`);
@@ -54922,7 +55052,7 @@ function formatTokenReport(result) {
   return lines.join("\n");
 }
 function isSyntheticPath(p2) {
-  return p2.startsWith("(") || p2.startsWith("~");
+  return isSyntheticBucket(p2) || p2.startsWith("~");
 }
 function formatSarif(result) {
   const severityToLevel = {
@@ -55244,7 +55374,7 @@ async function runCli() {
     new Option("--format <format>", "Output format: text, json, or sarif").choices(["text", "json", "sarif"]).default("text")
   ).option("--tokens", "Show token breakdown per file", false).option("--verbose", "Show passing checks too", false).option("--fix", "Auto-fix broken paths using git history and fuzzy matching", false).option("--fix-dry-run", "Preview --fix changes without writing", false).option("--yes", "Skip interactive confirmation prompts (required for --fix in TTY)", false).option("--follow-symlinks", "Allow --fix to write through symlinks (default: skip)", false).option("--ignore <checks>", "Comma-separated list of checks to ignore", "").option("--quiet", "Suppress all output except errors (exit code only)", false).option("--config <path>", "Path to config file (default: .ctxlintrc in project root)").option("--depth <n>", "Max subdirectory depth to scan (default: 2)", "2").option("--mcp", "Enable MCP config linting alongside context file checks", false).option("--mcp-only", "Run only MCP config checks, skip context file checks", false).option("--mcp-global", "Also scan user/global MCP config files (implies --mcp)", false).option("--mcp-server", "Start the MCP server (alias: `ctxlint serve`)").option("--mcph", "Enable .mcph.json (mcp.hosting CLI config) linting", false).option("--mcph-only", "Run only mcph config checks", false).option("--mcph-global", "Also scan ~/.mcph.json (implies --mcph)", false).option(
     "--mcph-strict-env-token",
-    "Upgrade mcph-config/prefer-env-token from warning to error (strict env-var-only posture)",
+    "Upgrade mcph-token-security/prefer-env-token from warning to error (strict env-var-only posture)",
     false
   ).option("--session", "Run session audit checks (cross-project consistency)", false).option("--session-only", "Run only session checks, skip context and MCP checks", false).option("--skills", "Run agent-skill checks (~/.claude/skills + ~/.claude/agents)", false).option("--skills-only", "Run only agent-skill checks, skip everything else", false).option(
     "--hooks-global",
@@ -55278,7 +55408,7 @@ async function runCli() {
       if (result.files.length === 0) {
         if (!options.quiet) {
           if (options.format === "json") {
-            console.log(JSON.stringify(result));
+            console.log(formatJson(result));
           } else if (options.format === "sarif") {
             console.log(formatSarif(result));
           } else {
@@ -55418,7 +55548,7 @@ Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${app
           let liveOptions = options;
           let liveActiveChecks = activeChecks;
           try {
-            const resolved = resolveSession(resolvedPath, opts);
+            const resolved = resolveSession(resolvedPath, opts, true);
             liveConfig = resolved.config;
             liveOptions = resolved.options;
             liveActiveChecks = resolved.activeChecks;
@@ -55540,9 +55670,9 @@ async function promptYesNo(question) {
     rl.close();
   }
 }
-function resolveSession(resolvedPath, opts) {
+function resolveSession(resolvedPath, opts, throwOnConfigError = false) {
   const configPath = opts.config ? path16.resolve(opts.config) : void 0;
-  const config2 = configPath ? loadConfigFromPath(configPath) : loadConfig(resolvedPath);
+  const config2 = configPath ? loadConfigFromPath(configPath, throwOnConfigError) : loadConfig(resolvedPath);
   const mcpGlobal = opts.mcpGlobal || config2?.mcpGlobal || false;
   const mcpOnly = opts.mcpOnly || config2?.mcpOnly || false;
   const mcpFlag = opts.mcp || mcpGlobal || mcpOnly || config2?.mcp || false;
@@ -55619,10 +55749,11 @@ function resolveSession(resolvedPath, opts) {
   const activeChecks = options.checks.filter((c3) => !options.ignore.includes(c3));
   return { config: config2, options, activeChecks };
 }
-function loadConfigFromPath(configPath) {
+function loadConfigFromPath(configPath, throwOnError = false) {
   try {
     return loadConfigFromExplicitPath(configPath);
   } catch (err) {
+    if (throwOnError) throw err;
     const detail = err instanceof Error ? err.message : String(err);
     console.error(`Error: ${detail}`);
     process.exit(2);